195.178.110.223
blockedPersistentRegularToolkit
Case file
First seen on 2026-09-15T02:52:59Z, most recently active on 2026-10-05T06:59:44Z.
Recorded 189 attack-shaped requests across 3 separate days.
Its traffic requested a .env file, hoping to find API keys or database credentials; it also requested a database dump or site archive by its common backup filename; it also requested the .git directory itself, hoping it is exposed and browsable.
Seen on our edge, web sensors.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS48090 (Techoff Srv Limited), an ASN we classify as hosting.
Blocked by the firewalls on our servers since 2026-10-05T07:10:04Z, through 2027-10-05T07:10:04Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS48090 — Techoff Srv Limited |
| ASN type | hosting |
| Country | Bulgaria (BG) |
| Flags | none observed |
Timeline
- 2026-09-151
- 2026-09-191
- 2026-10-05187
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T06:59:44Z | web | aeroways.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /secrets/aws.yml -> 404 |
| 2026-10-05T06:59:43Z | web | aeroways.eu | made a request that matched no known pattern | 404 | GET /config/aws.yaml -> 404 |
| 2026-10-05T06:59:43Z | web | aeroways.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config/aws.yml -> 404 |
| 2026-10-05T06:59:43Z | web | aeroways.eu | requested a .env file, hoping to find API keys or database credentials | 404 | GET /.env.aws -> 404 |
| 2026-10-05T06:59:43Z | web | aeroways.eu | requested a database dump or site archive by its common backup filename | 404 | GET /.aws/credentials.bak -> 404 |
| 2026-10-05T06:59:42Z | web | aeroways.eu | requested a .env file, hoping to find API keys or database credentials | 404 | GET /.env.production -> 404 |
| 2026-10-05T06:59:42Z | web | aeroways.eu | 2 × made a request that matched no known pattern | 404 | GET /secrets/aws.json -> 404 (2 distinct paths) |
| 2026-10-05T06:59:41Z | web | aeroways.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /.aws/config -> 404 |
| 2026-10-05T06:59:41Z | web | aeroways.eu | requested an AWS credentials file left in a web-accessible path by mistake | 404 | GET /.aws/credentials -> 404 |
| 2026-10-05T06:59:38Z | web | aeroways.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /secrets/aws.yml -> 404 |
| 2026-10-05T06:59:38Z | web | aeroways.eu | made a request that matched no known pattern | 404 | GET /config/aws.yaml -> 404 |
| 2026-10-05T06:59:37Z – 2026-10-05T06:59:38Z | web | aeroways.eu | 2 × requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config/aws.yml -> 404 |
| 2026-10-05T06:59:37Z | web | aeroways.eu | requested a .env file, hoping to find API keys or database credentials | 404 | GET /.env.aws -> 404 |
| 2026-10-05T06:59:37Z | web | aeroways.eu | requested a database dump or site archive by its common backup filename | 404 | GET /.aws/credentials.bak -> 404 |
| 2026-10-05T06:59:37Z | web | aeroways.eu | requested a .env file, hoping to find API keys or database credentials | 404 | GET /.env.production -> 404 |
| 2026-10-05T06:59:36Z – 2026-10-05T06:59:37Z | web | aeroways.eu | 3 × made a request that matched no known pattern | 404 | GET /secrets/aws.json -> 404 (2 distinct paths) |
| 2026-10-05T06:59:36Z | web | aeroways.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /.aws/config -> 404 |
| 2026-10-05T06:59:36Z | web | aeroways.eu | requested an AWS credentials file left in a web-accessible path by mistake | 404 | GET /.aws/credentials -> 404 |
| 2026-10-05T06:59:35Z | web | aeroways.eu | made a request that matched no known pattern | 404 | GET /config/firebase-adminsdk.json -> 404 |
| 2026-10-05T06:59:35Z | web | aeroways.eu | 2 × requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | GET /google-credentials.json -> 403 (2 distinct paths) |
| 2026-10-05T06:59:29Z | web | aeroways.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | /.git -> 403 |
| 2026-10-05T06:59:29Z | web | aeroways.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | GET /.git/hooks/pre-push -> 403 |
| 2026-10-05T06:59:27Z | web | aeroways.eu | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/v2/config -> 404 |
| 2026-10-05T06:59:27Z | web | aeroways.eu | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /assets/config.json -> 404 |
| 2026-10-05T06:59:26Z – 2026-10-05T06:59:27Z | web | aeroways.eu | 2 × requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/v1/config -> 404 (2 distinct paths) |
| 2026-10-05T06:59:25Z | web | aeroways.eu | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /public/config.json -> 404 |
| 2026-10-05T06:59:24Z | web | aeroways.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | /.git -> 403 |
| 2026-10-05T06:59:24Z | web | aeroways.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | GET /.git/hooks/pre-push -> 403 |
| 2026-10-05T06:59:24Z | web | aeroways.eu | 2 × requested a database dump or site archive by its common backup filename | 404 | GET /aeroways-2026.sql.gz -> 404 (2 distinct paths) |
| 2026-10-05T06:59:24Z | web | aeroways.eu | 2 × requested a database dump or site archive by its common backup filename | 403 | GET /aeroways-2026.sql -> 403 (2 distinct paths) |
| 2026-10-05T06:59:23Z | web | aeroways.eu | requested a database dump or site archive by its common backup filename | 404 | GET /aeroways-2025.sql.gz -> 404 |
| 2026-10-05T06:59:23Z | web | aeroways.eu | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/v2/config -> 404 |
| 2026-10-05T06:59:23Z | web | aeroways.eu | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /assets/config.json -> 404 |
| 2026-10-05T06:59:23Z | web | aeroways.eu | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/v1/config -> 404 |
| 2026-10-05T06:59:22Z | web | aeroways.eu | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /static/config.json -> 404 |
| 2026-10-05T06:59:22Z | web | aeroways.eu | made a request that matched no known pattern | 404 | GET /config/runtime.json -> 404 |
| 2026-10-05T06:59:22Z | web | aeroways.eu | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T06:59:22Z | web | aeroways.eu | requested a database dump or site archive by its common backup filename | 404 | GET /backup-2025.sql.gz -> 404 |
| 2026-10-05T06:59:21Z | web | aeroways.eu | 2 × requested a database dump or site archive by its common backup filename | 403 | GET /backup-2025.sql -> 403 (2 distinct paths) |
| 2026-10-05T06:59:21Z | web | aeroways.eu | requested a database dump or site archive by its common backup filename | 404 | GET /aeroways-2024.sql.gz -> 404 |
| 2026-10-05T06:59:21Z | web | aeroways.eu | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /public/config.json -> 404 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 195.178.110.223. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
